ISO 27001 Clause 9.3 Management Review (+ Free Template)

A management review is a formal, scheduled meeting where an organisation’s top management steps back and judges whether its information security management system (ISMS) is still suitable, adequate and effective. It is not a technical review of controls — it is a leadership decision-making meeting, backed by evidence, that sets the direction of the ISMS for the next period.

Under ISO/IEC 27001:2022 Clause 9.3 this review is mandatory. Auditors treat it as proof that leadership — not just the security team — owns information security.

Clause 9.3 is one of the clauses certification auditors check first, because a missing or thin management review signals that security isn’t driven from the top. A well-run review demonstrates three things at once:

Leadership ownership — top management actively reviews and directs the ISMS.
A closed loop — findings, risks and metrics feed decisions, and those decisions become tracked actions.
Continual improvement — the ISMS adapts to changing risks, not just a once-a-year box-tick.

Clause 9.3.1 requires reviews “at planned intervals” without naming a frequency. In practice:

Annually is the absolute minimum most certification bodies expect.
Quarterly is the common cadence for growing SaaS and cloud companies — frequent enough to act on risks, light enough to sustain.
Hold an additional ad-hoc review after a major change: a serious incident, a new regulation, an acquisition, or a significant architecture shift.

The agenda must cover every one of these inputs — auditors check each is evidenced in the minutes:

a) Status of actions from previous management reviews
b) Changes in external and internal issues relevant to the ISMS
c) Changes in the needs and expectations of interested parties
d) Information security performance — nonconformities and corrective actions, monitoring and measurement results, audit results, and fulfilment of security objectives
e) Feedback from interested parties
f) Results of risk assessment and the status of the risk treatment plan
g) Opportunities for continual improvement

The review’s outputs must be documented and must include:

Decisions related to continual improvement opportunities, and
Any need for changes to the ISMS.

Record each decision with an owner and a due date, and keep the minutes as retained documented information. That attendee list, the decisions, and the dated action items are exactly what an auditor asks to see.

Assign three roles and the review runs smoothly:

Chair — a member of top management (e.g. CEO/CTO), who owns the decisions.
ISMS manager / CISO — prepares the inputs pack (metrics, audit results, risk status) in advance.
Minute taker — records attendees, decisions and actions against each agenda item.

Circulate the inputs pack before the meeting so the time is spent on judgement and decisions, not on reading numbers for the first time.

Walk the agenda in Clause 9.3.2 order, then capture the outputs. A completed decisions log — the audit evidence — looks like this:

#	Decision / change to the ISMS	Owner	Due
1	Automate the quarterly access-review workflow	CTO	2026-11-30
2	Expand the ISMS scope statement to the new cloud region	ISMS Manager	2026-11-15
3	Add DPDP controls to the Statement of Applicability	DPO	2026-11-20
4	Close the security-training gap to 100%	Head of HR	2026-11-10

The downloadable template below gives you the full agenda, an attendees table, the performance KPIs, the risk and improvement sections, and an action-item log — ready to fill in.

Missing an input. Skipping even one Clause 9.3.2 input (interested-party feedback is the usual casualty) is a finding. The template has a section for each.
Decisions with no owner or date. Outputs must be actionable and tracked, or they’re just discussion.
No link to the next review. Last review’s actions must be revisited this time (input a) — close the loop.
Treating it as a security-team meeting. Clause 9.3 is explicit that top management conducts the review.

Use our free, editable ISO 27001:2022 Clause 9.3 Management Review template (Word) to run your next review. It maps one-to-one to the required inputs and outputs, so nothing gets missed, and doubles as your audit-ready minutes. Enter your details below and we’ll reveal the download and email you a copy.

ISO 27001 Clause 9.3: The Management Review

What is an ISO 27001 management review?

Why Clause 9.3 matters

How often should you hold it?

The required inputs (Clause 9.3.2)

The required outputs (Clause 9.3.3)

How to run the meeting

A sample agenda & decisions

Common audit pitfalls

Download the free template

ISO 27001:2022 Management Review Template (Clause 9.3)